d9c95e33e13819aa7e170d4deac95b01c2fd8a8d2653f1ffc6c13ccf5acd2c6c

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 00:56

Target
WallpaperLocker.exe
Size 111.0MB
Sample261014-back3swxa1
SHA256 d9c95e33e13819aa7e170d4deac95b01c2fd8a8d2653f1ffc6c13ccf5acd2c6c
MD5 514e81c34dd7ffe402f5b176ef8fa1ed
SHA1 ace4c1a661c9d836c91ec498272a3e44f13d565d
SHA512 cbb537dcc3dcf445ceaf092280ce6343f42e9d768cbb26aac28520aaaf9f18b523e30955d851e69a981e2fb06a4627b2aefff4a83dcc2100bc44de7aafa876c5
SSDEEP 786432:YIpq0a2o6oHhjx0EGnkvUOH06y52pxtfPGnlgC9X6KPu+DpwoP3X:YIw0A6oHNvgQXGlV9X6KPuOffX
TLSH
T142487C1163E86E45E23B8278977786A1D675BC525311C2CF0094FD4A3F73BC2BA363A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
4112	WallpaperLocker.exe
52	WallpaperLocker.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

Defacement

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\WallpaperLocker\\Wallpapers\\wallpaper.png"	WallpaperLocker.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
776	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
776	powershell.exe
776	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	776	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4112	4860	WallpaperLocker.exe	90
PID 4112 wrote to memory of 3704	4112	WallpaperLocker.exe	91
PID 4112 wrote to memory of 776	4112	WallpaperLocker.exe	93
PID 776 wrote to memory of 4212	776	powershell.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WallpaperLocker.exe
"C:\Users\Admin\AppData\Local\Temp\WallpaperLocker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\ProgramData\WallpaperLocker\WallpaperLocker.exe
  "C:\ProgramData\WallpaperLocker\WallpaperLocker.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /F /SC MINUTE /MO 5 /RL HIGHEST /TN "WallpaperLocker" /TR ""C:\ProgramData\WallpaperLocker\WallpaperLocker.exe""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -Command "gpupdate /target:computer /force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:776
  - - C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /target:computer /force
      4⤵
      PID:4212